Bump the test-dependencies group with 5 updates by dependabot[bot] · Pull Request #283 · CaffeinatedCoder/CodoMetis.TypeKit

dependabot · 2026-11-01T13:54:00Z

Updated cyclonedx from 6.2.0 to 6.3.1.

Release notes

6.3.1 Fixed

Fixes a regression in 6.3.0 where Microsoft.ML.OnnxRuntime.Gpu and its managed/native dependencies were classified as development-only and removed by --exclude-dev (#1139, #1140).

Build-only runtime aggregation wrappers are now retained as Required when their restored dependency closure provides positive evidence in an allowed runtime-capable category. The refinement is target-local and preserves explicit development-only asset selections, standalone build-only/analyzer/tool filtering, test-only exclusion, and production runtime sharing.

Intentional limitation

Restored dependency graphs cannot distinguish every runtime wrapper from a build-tool wrapper with the same observable assets. Conservative retention may therefore also retain ambiguous build-tool closures. PrivateAssets controls propagation, not development intent, and alone does not guarantee exclusion. This is not an exact publish-output scanner.

Validation

Cross-platform .NET CI and Docker E2E tests pass. A real consumer referencing only Microsoft.ML.OnnxRuntime.Gpu 1.25.1 was also restored and published for linux-x64; native runtime loading and XML/JSON SBOM closure retention with --exclude-dev were verified. GPU inference was not tested.

Thanks

Thank you @wahyuen (Wah Yuen) for reporting the regression and providing the reproduction details!

Update

dotnet tool update --global CycloneDX --version 6.3.1

Docker image: cyclonedx/cyclonedx-dotnet:6.3.1 (also published as latest).

6.3.0 Added

NuGet purls for project references (#1137, fixes #1136): combining --set-nuget-purl with --include-project-references generates missing project purls. Existing purls and custom BOM references are preserved, and dependency edges use the final references.

Changed

Development dependency scopes (#1138): development dependencies and their development-only transitive dependencies are included by default with scope="excluded". Packages shared with production runtime use remain required.
--exclude-dev is deprecated but continues to filter: it omits development-only and test-project-only packages while retaining packages shared with production runtime use.

Fixed

Assembly-name resolution (#1128, fixes #917): resolve $(RootNamespace) in assembly names, including nested $(MSBuildProjectName) tokens. Missing, empty, or circular $(AssemblyName)-referencing namespaces fall back to the project filename. This is best-effort substitution, not full MSBuild evaluation.
Exclusion filtering (#1135, fixes #1133): --exclude-filter removes only packages it newly orphans; pre-existing orphans are retained.
Target-framework regression coverage (#1131, fixes #1126): verifies exclusion filtering for non-normalized target frameworks, including net48, netstandard2.0, Net8.0, and Windows-qualified TFMs. The underlying NuGet.ProjectModel 7.6.0 fix was already included in 6.2.1.

Contributors

Thanks to everyone who contributed code, tests, and issue reports to this release:

@MichaelKopfMkf — NuGet purls for project references (#1137, #1136).
@mtsfoni — development dependency scopes and compatible exclusion behavior (#1138).
@uo-uhbc — exclusion-filter orphan handling fix and reproduction (#1135, #1133).
@mgnslndh — regression coverage for exclusion filtering on non-normalized target frameworks (#1131).
@Eljees — root-namespace assembly-name resolution fix (#1128).
@TobiDimmel — reported the assembly-name property resolution issue (#917).
@jasonlhills — reported the exclusion-filter failure (#1126).

🎉 New Contributors

A warm welcome and a big thank you to our first-time contributors:

@MichaelKopfMkf made their first contribution in #1137.
@mgnslndh made their first contribution in #1131.
@Eljees made their first contribution in #1128.

Full changelog: CycloneDX/cyclonedx-dotnet@v6.2.1...v6.3.0

6.2.1 CycloneDX for .NET 6.2.1

This patch release fixes dependency resolution in multi-project solutions and hash computation for uncached NuGet packages.

Fixed

Resolve dependency ranges with multiple matching package versions (#1113, fixes #1110) — solution scans no longer fail with Sequence contains more than one matching element when multiple merged package versions satisfy an unresolved NuGet dependency range. The BOM now retains a dependency edge to every matching component.
Fix hash computation for uncached NuGet packages (#1099) — reset the package stream before computing hashes when falling back to downloading an uncached .nupkg.

Changed

Update .NET dependencies and CI tooling.
Upgrade Testcontainers to 4.16.0 to resolve SSH.NET security advisories in the E2E test infrastructure. This is a test-infrastructure update, not a runtime dependency change to the CLI.

Documentation

Add a best-practices guide covering root project targeting, restore-first workflows, and BOM metadata setup.

Contributors

Thanks to everyone who contributed to this release:

@LukasChristel — fix hash computation for uncached NuGet packages (#1099).
@michael-eberhard-skidata — report and reproduction for the multi-version dependency range failure (#1110).
@mtsfoni — dependency range resolution fix and regression coverage (#1113).

Full changelog: CycloneDX/cyclonedx-dotnet@v6.2.0...v6.2.1

Commits viewable in compare view.

Updated JsonSchema.Net from 9.4.1 to 9.6.0.

Release notes

Sourced from JsonSchema.Net's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated NodaTime from 3.3.5 to 3.3.7.

Release notes

Sourced from NodaTime's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Serilog from 4.0.0 to 4.4.0.

Release notes

Sourced from Serilog's releases.

4.4.0 What's Changed

Emit SelfLog warning when extra arguments are provided by @matantsach in Emit SelfLog warning when extra arguments are provided serilog/serilog#2222
dont WriteQuotedJsonString for null by @SimonCropp in dont WriteQuotedJsonString for null serilog/serilog#2216
Pin System.Security.Cryptography.Xml to 8.0.3 in tests by @ArieGato in Pin System.Security.Cryptography.Xml to 8.0.3 in tests serilog/serilog#2232
Route optional interfaces through OptionalInterfaceForwardingSink for restricted sinks by @ArieGato in Route optional interfaces through OptionalInterfaceForwardingSink for restricted sinks serilog/serilog#2234
SelfMetrics by @nblumhardt in SelfMetrics serilog/serilog#2237

New Contributors

@matantsach made their first contribution in Emit SelfLog warning when extra arguments are provided serilog/serilog#2222
@ArieGato made their first contribution in Pin System.Security.Cryptography.Xml to 8.0.3 in tests serilog/serilog#2232

Full Changelog: serilog/serilog@v4.3.1...v4.4.0

4.3.1 What's Changed

Remove SourceLink by @SimonCropp in remove SourceLink serilog/serilog#2183
Handle Exception.ToString failures in text formatter by @krisbiradar in Handle Exception.ToString failures in text formatter serilog/serilog#2197
Remove char[] allocation by @karpinsn in Remove char[] allocation serilog/serilog#2198
Remove backpressure from XMLDoc by @timothycoleman in Remove backpressure from XMLDoc serilog/serilog#2203
Don't enable XDOC for tests by @nblumhardt in Don't enable XDOC for tests serilog/serilog#2205
Target and test on net10 by @SimonCropp in target and test on net10 serilog/serilog#2206
Fix trimming error when Serilog is a transitive dependency by @Numpsy in Package Serilog.targets as 'buildTransitive' as well as 'build' serilog/serilog#2214
Inline TraceId and SpanId JSON string formatting by @SimonCropp in Inline TraceId and SpanId JSON string formatting serilog/serilog#2215

New Contributors

@krisbiradar made their first contribution in Handle Exception.ToString failures in text formatter serilog/serilog#2197
@karpinsn made their first contribution in Remove char[] allocation serilog/serilog#2198
@timothycoleman made their first contribution in Remove backpressure from XMLDoc serilog/serilog#2203
@Numpsy made their first contribution in Package Serilog.targets as 'buildTransitive' as well as 'build' serilog/serilog#2214

Full Changelog: serilog/serilog@v4.3.0...v4.3.1

4.3.0 What's Changed

#2149 - LogEvent.AddPropertyIfAbsent(ILogEventPropertyFactory, ...) overload that helps avoid allocations (@vanni-giachin)
#2158 - use HTTPS in all README.md images and links (@TimHess)
#2163 - LogContext.Push() overloads accepting IEnumerable<ILogEventEnricher> and ReadOnlySpan<ILogEventEnricher> (@SimonCropp)
#2175, #2178, #2179 - fix AOT compatibility (@agocke)

New Contributors

@vanni-giachin made their first contribution in Property factory as AddPropertyIfAbsent parameter serilog/serilog#2149
@TimHess made their first contribution in Use HTTPS in README.md images and links serilog/serilog#2158

Full Changelog: serilog/serilog@v4.2.0...v4.3.0

4.2.0 What's Changed

#2141 — stabilize and fully implement dotted identifiers in message templates (@nblumhardt)
#2028 — use RuntimeHelpers.GetHashCode() in message template cache comparer (@sungam3r)
#2138 — update to .NET 9 SDK, GitHub Actions build, net9.0 TFM (@nblumhardt)
#2132 — support capturing of multidimensional arrays (@sungam3r, @WAcry)
#2136 — fix documentation for ILogEventSink (@erichiller)

New Contributors

@WAcry made their first contribution in Extend Support for Multi-Dimensional Arrays serilog/serilog#2132

Full Changelog: serilog/serilog@v4.1.0...v4.2.0

4.1.0

#2108 - failure listeners and fallback sinks (@nblumhardt)
#2120 - add BatchingOptions.RetryTimeLimit and update retry scheduling algorithm (@nblumhardt)

Important note

IBatchedLogEventSink batch retry scheduling has changed in this version. The default configuration still tries failed batches for approximately ten minutes, but the BufferingTimeLimit no longer implicitly causes the retry time to be extended or reduced. If you need a specific retry time, set BatchingOptions.RetryTimeLimit, which reliably controls retry time.

4.0.2

#2094 - remove boxing and string allocations in output template formatting (@epeshk)
#2103 - don't capture properties with private get accessors (@nblumhardt)
#2095 - remove junk file (@Numpsy)
#2116 - fall back to IDisposable in Log.CloseAndFlushAsync() when the target logger is not IAsyncDisposable (@nblumhardt)

4.0.1

#2090 — when capturing structured values, reuse HashSet instances, reduce LINQ usage, avoid reallocating string[] to improve performance and cut GC pressure (@nblumhardt)
#2089 - allow capturing of non-anonymous structured values when trimming (@nblumhardt)
#2083 - use Major.Minor.0.0 assembly versioning (@nblumhardt)

Commits viewable in compare view.

Updated System.Security.Cryptography.Pkcs from 9.0.21 to 10.0.14.

Release notes

Sourced from System.Security.Cryptography.Pkcs's releases.

10.0.0-preview.6.25358.103

You can build .NET 10.0 Preview 6 from the repository by cloning the release tag v10.0.0-preview.6.25358.103 and following the build instructions in the main README.md.